f8f2687929c423ce0b113b9badba3481b2a1faf07ddc94677d214a87a651dee3

Sharing

Copy URL Twitter E-mail

General

Target

f8f2687929c423ce0b113b9badba3481b2a1faf07ddc94677d214a87a651dee3
Size

136KB
MD5

74ebfbb299398c5ca986f94edf823d5e
SHA1

7761c4667c7efce4b38cc40b3d335c4901efec69
SHA256

f8f2687929c423ce0b113b9badba3481b2a1faf07ddc94677d214a87a651dee3
SHA512

770f4b60b1cd65bd0eda75d4737f17214bda71d3358626da1b14846b0c05fc08347a87aed2f1de45269d4c276228a7ba60cc5f6a638ea133870b61d982bbfe46
SSDEEP

3072:AuwPoih3CKKxcp334rX858c0K1dgFETDsbwkc:ARoiVC7xcp3ILwdhTDsbBc

Score

N/A

Malware Config

Signatures

Files

f8f2687929c423ce0b113b9badba3481b2a1faf07ddc94677d214a87a651dee3
.dll windows x86

abf442b75e0d9ee5d382b4cb95fb59c6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetComputerNameA
FileTimeToSystemTime
FileTimeToLocalFileTime
LocalFree
FormatMessageA
TerminateProcess
LoadLibraryA
GetModuleHandleA
GetSystemDirectoryA
InterlockedDecrement
GetPrivateProfileStringA
WritePrivateProfileStringA
CreateProcessA
GetStartupInfoA
GlobalLock
GlobalUnlock
GlobalSize
GlobalFree
TerminateThread
SetThreadAffinityMask
lstrcmpiA
GetSystemInfo
FreeLibrary
GlobalAlloc
GetLocalTime
SetLastError
GetCurrentThreadId
GlobalReAlloc
GetTickCount
CreateMutexA
ReleaseMutex
MoveFileExA
GetTempFileNameA
GetTempPathA
SetCurrentDirectoryA
GetLogicalDriveStringsA
GetDriveTypeA
GetDiskFreeSpaceExA
GlobalMemoryStatus
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
CreateThread
Sleep
FindFirstFileA
lstrcmpA
CreateDirectoryA
GetLastError
RemoveDirectoryA
GetFileAttributesA
SetFileAttributesA
FindNextFileA
FindClose
CopyFileA
DeleteFileA
GetModuleHandleW
GetProcAddress
GetModuleFileNameA
OpenProcess
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
VirtualFree
WaitForSingleObject
GetExitCodeThread
CreateToolhelp32Snapshot
Process32First
Process32Next
GetVersionExA
GetCurrentProcess
GetCurrentThread
CloseHandle

user32

GetThreadDesktop
GetProcessWindowStation
CloseDesktop
OpenInputDesktop
GetUserObjectInformationA
GetDesktopWindow
ReleaseDC
GetWindowRect
GetWindowDC
OpenWindowStationA
SetCursorPos
mouse_event
keybd_event
DispatchMessageA
TranslateMessage
PeekMessageA
SendMessageA
IsWindow
SetProcessWindowStation
OpenDesktopA
LoadCursorA
SetThreadDesktop
ExitWindowsEx
DestroyIcon
PostMessageA
GetSystemMetrics
GetDC
SetCursor
CloseWindowStation

gdi32

DeleteDC
DeleteObject
GetDIBits
RealizePalette
SelectPalette
GetStockObject
GetObjectA
BitBlt
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC

advapi32

RegCreateKeyExA
RegSetValueExA
RegEnumValueA
RegEnumKeyA
RegOpenKeyExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
ImpersonateLoggedOnUser
GetUserNameA
RevertToSelf
RegQueryValueExA
RegOpenKeyA
RegDeleteValueA

shell32

ShellExecuteA

ole32

OleRun
CoCreateInstance
CoInitialize

oleaut32

SysAllocString
VariantClear
GetErrorInfo
SysAllocStringByteLen
SysStringByteLen
SysFreeString

userenv

UnloadUserProfile
LoadUserProfileA

shlwapi

SHDeleteKeyA

ws2_32

select
WSASocketA
WSACloseEvent
closesocket
shutdown
WSAGetOverlappedResult
WSAResetEvent
WSAWaitForMultipleEvents
WSAGetLastError
WSASend
WSARecv
connect
htons
inet_addr
WSAStartup
gethostbyaddr
inet_ntoa
ntohs
recv
WSAIoctl
bind
gethostbyname
gethostname
socket
WSACleanup
__WSAFDIsSet
WSACreateEvent
send
ioctlsocket

setupapi

SetupDiEnumDeviceInfo
SetupDiOpenClassRegKey
SetupDiGetClassDevsA
SetupDiCallClassInstaller
SetupDiSetClassInstallParamsA

msvcrt

fflush
abs
wcslen
_CxxThrowException
??1type_info@@UAE@XZ
_iob
_initterm
_adjust_fdiv
__dllonexit
_onexit
_stricmp
_itoa
_strupr
_strnicmp
calloc
fprintf
exit
mktime
difftime
_strdup
rename
toupper
strncmp
strtok
_snprintf
isspace
sscanf
strchr
time
localtime
_ftol
_local_unwind2
_except_handler3
free
malloc
__CxxFrameHandler
printf
fseek
ftell
fread
sprintf
fopen
fwrite
fclose
atoi
strstr
strrchr
strcmp
strncpy
strncat
??2@YAPAXI@Z
memcpy
??3@YAXPAX@Z
memset
strlen
strcpy
strcat

dnsapi

DnsQuery_A
DnsRecordListFree

avicap32

capCreateCaptureWindowA
capGetDriverDescriptionA

Exports

Exports

?fnServerDll3@@YAHXZ
?nServerDll3@@3HA
DownCtrlAltDel
StartupServer
WinShutdown

Sections

.text
Size: 80KB - Virtual size: 77KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 642KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

abf442b75e0d9ee5d382b4cb95fb59c6

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

userenv

shlwapi

ws2_32

setupapi

msvcrt

dnsapi

avicap32

Exports

Exports

Sections

.text Size: 80KB - Virtual size: 77KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 32KB - Virtual size: 642KB

.reloc Size: 12KB - Virtual size: 8KB

.text
Size: 80KB - Virtual size: 77KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 32KB - Virtual size: 642KB

.reloc
Size: 12KB - Virtual size: 8KB